EUVD-2011-5168

Malware in sbrugna...

EUVD-2013-7029

Malware in sbrugna...

EUVD-2013-7028

Malware in sbrugna...

CVE-2011-5269

Cross-site scripting XSS vulnerability in ProjectForge before 3.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a validation message...

ProjectForge跨站请求伪造和跨站脚本漏洞

ProjectForge是一个基于Web的项目管理解决方案包括:工时表Timesheet、费用管理、项目甘特图,控制和管理工程分解结构。 1 某些未明输入在用于JSON自动完成响应前未能正确过滤，攻击者可以在用户访问恶意数据时，利用漏洞在用户浏览器会话上下文中注入任意HTML和脚本代码。 2程序允许用户不进行适当的有效性检查，通过HTTP请求执行某些操作。当登录的用户访问特制的网页时，攻击者可以执行某些未指定的操作。 0 ProjectForge 5.x ProjectForge 5.3版本以修复此漏洞，建议用户下载使用： http://www.projectforge.org/...

CVE-2013-7251

Multiple cross-site request forgery CSRF vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to 1 web/admin/, 2 web/core/, 3 web/dialog/, 4 web/fibu/, 5 web/mobile/, 6 web/task/, or 7 web/wicket/...

CVE-2013-7250

Cross-site scripting XSS vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion string, related to web/core/JsonBuilder.java and web/wicket/autocompletion/PFAutoCompleteBehavior.java...

CVE-2011-5269

Cross-site scripting XSS vulnerability in ProjectForge before 3.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a validation message...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to 1 web/admin/, 2 web/core/, 3 web/dialog/, 4 web/fibu/, 5 web/mobile/, 6 web/task/, or 7 web/wicket/...

Cross site scripting

Cross-site scripting XSS vulnerability in ProjectForge before 3.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a validation message...

Cross site scripting

Cross-site scripting XSS vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion string, related to web/core/JsonBuilder.java and web/wicket/autocompletion/PFAutoCompleteBehavior.java...

CVE-2013-7250

Cross-site scripting XSS vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion string, related to web/core/JsonBuilder.java and web/wicket/autocompletion/PFAutoCompleteBehavior.java...

CVE-2013-7250

CVE-2013-7250: XSS in ProjectForge (JsonBuilder) before 5.3 allows remote authenticated users to inject scripts via an autocompletion string. Affected: web/core/JsonBuilder.java and web/wicket/autocompletion/PFAutoCompleteBehavior.java. Impact: cross-site scripting; fix/mitigation: upgrade to 5.3...

CVE-2013-7251

CVE-2013-7251 concerns CSRF vulnerabilities in ProjectForge prior to version 5.3, enabling remote attackers to hijack user authentication via multiple web paths (web/admin/, web/core/, web/dialog/, web/fibu/, web/mobile/, web/task/, web/wicket/). Affected product: ProjectForge; affected component...

CVE-2011-5269

CVE-2011-5269 affects ProjectForge prior to 3.5.3, where remote authenticated users can inject arbitrary web script or HTML through a validation message (XSS). The issue arises in the validation/message handling, enabling script execution in an authenticated user’s context. No exploitation detail...

CVE-2011-5269

Cross-site scripting XSS vulnerability in ProjectForge before 3.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a validation message...

CVE-2013-7251

Multiple cross-site request forgery CSRF vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to 1 web/admin/, 2 web/core/, 3 web/dialog/, 4 web/fibu/, 5 web/mobile/, 6 web/task/, or 7 web/wicket/...

PT-2014-3306

Name of the Vulnerable Software and Affected Versions ProjectForge versions prior to 5.3 Description The issue allows remote attackers to hijack the authentication of arbitrary users. This is achieved through multiple cross-site request forgery CSRF vulnerabilities related to various API endpoint...

PT-2014-3305

Name of the Vulnerable Software and Affected Versions ProjectForge versions prior to 5.3 Description A cross-site scripting XSS issue exists due to an improper implementation in the JsonBuilder. This allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion...

PT-2014-2186

Name of the Vulnerable Software and Affected Versions ProjectForge versions prior to 3.5.3 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via a validation message. Recommendations For versions prior to 3.5.3, update to version...